CVE-2026-85632

{
  "etk_id": "ETK-2026-4197",
  "cve_id": "CVE-2026-85632",
  "display_id": "CVE-2026-85632",
  "ghsa_id": "GHSA-vj53-8xx8-xcpf",
  "euvd_id": "EUVD-2026-123529",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authentication bypass in WooCommerce Virtual POS Module",
  "summary": "WooCommerce Virtual POS Module versions 26.8.3 through versions before 26.9.1 are affected. An attacker able to intercept communications could bypass authentication and modify API messages.",
  "mitigation": "Upgrade WooCommerce Virtual POS Module to version 26.9.1 or later. Until the upgrade is complete, limit payment API communications to trusted network paths and investigate unexpected transaction or API activity.",
  "vendor": "Sipay Electronic Money and Payment Services Inc.",
  "product": "WooCommerce Virtual POS Module",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 26.8.3, < 26.9.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "26.9.1"
      ],
      "package_name": "WooCommerce Virtual POS Module",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 9.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 35.823349916666665,
  "t0_at": "2026-11-11T14:24:31.418000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-11T18:52:38.227545+00:00",
      "days": 0.18618992528935185,
      "is_lower_bound": false,
      "measured_at": "2026-11-11T14:24:31.418000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-11T14:24:31.418000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-11T14:24:31.418000+00:00",
      "url": "https://github.com/advisories/GHSA-vj53-8xx8-xcpf"
    }
  }
}